Splunk Search

How to extract a field from a long path name?

splunker9999
Path Finder

HI

We need to create a new field for file name and this is to be extracted from path we have.

We need to extract last segment from below path which is jst_cat_20170119164505.xfrfrom below path .
Format of path is as below

/home/ist/user/dealer/jst_cat_20170119164505.xfr
/home/dlr/user/ist_cat_20116091456.xfr.pdt
/home/dlr/user/ist_cat/dealer/files.20160910.txt
/home/dlr/user/ist_cat/dealer/files.20160910.txt.pdt

Thanks

0 Karma

gokadroid
Motivator

If all of these urls are in individual events then this extraction shall give you desired result:

your command to return events
| rex "\/(([^\s\/]+\/)*)(?<fileName>[\S]+)"
| table fileName

If all of these are in single event then use the max_match=0 something like this

your command to return events
| rex max_match=0 "\/(([^\s\/]+\/)*)(?<fileName>[\S]+)"
| mvexpand fileName
| table fileName
0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...